Ctf Writeup Lookup

---
name: CTF Writeup Lookup
description: |
  This skill should be used when stuck on a CTF challenge or when the user
  asks to look up a writeup. Use EARLY when brute forcing or guessing
  seems like the only option - writeups often reveal the intended path.
  Trigger on: "look up writeup", "how do others solve", "stuck",
  "what's the intended path", machine names like "Soulmate", "Headless".
version: 1.0.0
---

# CTF Writeup Lookup Skill

## When to Use

**Use this skill EARLY when:**
- You've been stuck for more than 10-15 minutes
- The only remaining option seems to be brute forcing
- You find an unusual service with no obvious exploit
- User explicitly asks for writeup
- Machine name is known (search: "HTB <machine_name> writeup")

## Search Strategies

### HackTheBox Machines
```
# Primary search
"HackTheBox <machine_name> writeup"
"HTB <machine_name> walkthrough"

# With service focus
"HTB <machine_name> <service> exploit"
"HackTheBox <machine_name> privilege escalation"
```

### TryHackMe Rooms
```
"TryHackMe <room_name> writeup"
"THM <room_name> walkthrough"
```

### Generic CTF
```
"<ctf_name> <challenge_name> writeup"
"<challenge_name> CTF solution"
```

## Quality Sources

### Tier 1 (Most Reliable)
- **0xdf.gitlab.io** - Detailed, well-explained
- **ippsec.rocks** - Video walkthroughs with transcripts
- **HackTheBox Official** - After machine retires

### Tier 2 (Good Coverage)
- **Medium.com** - Many writeups, variable quality
- **infosecwriteups.com** - Curated content
- **GitHub repos** - Often have exploit scripts

### Tier 3 (Quick Reference)
- **YouTube** - Visual walkthroughs
- **Personal blogs** - May have unique approaches

## What to Extract from Writeups

### Initial Access
- Exact CVE or vulnerability used
- Exploit command/script
- Credentials found
- Service-specific tricks

### Privilege Escalation
- Exact technique (SUID, cron, capability, etc.)
- Password/key locations
- Service misconfigurations
- Intended vs unintended paths

### Key Information Template

```markdown
## Writeup Summary: <Machine Name>

### Initial Access
- **Vector**: <CVE/technique>
- **Service**: <service name and version>
- **Exploit**: <command or script>
- **Creds Found**: <username:password if any>

### User Privilege Escalation
- **From**: <initial user>
- **To**: <target user>
- **Method**: <technique>
- **Key Finding**: <password location, config file, etc.>

### Root Privilege Escalation
- **Method**: <technique>
- **CVE**: <if applicable>
- **Key Finding**: <what to look for>

### Credentials Discovered
| Username | Password | Source |
|----------|----------|--------|
| <user> | <pass> | <where found> |

### Files to Check
- <path/to/important/file>
- <another/key/location>
```

## Search Examples

### Example: Stuck on CrushFTP
```
Search: "CrushFTP CVE 2025 authentication bypass"
Search: "CrushFTP HTB exploit"
Search: "CrushFTP penetration testing"
```

### Example: Unknown Service on Port 2222
```
Search: "SSH port 2222 not OpenSSH exploit"
Search: "Erlang SSH CVE"
Search: "port 2222 4369 Erlang exploitation"
```

### Example: Need Password for User
```
Search: "HTB <machine> <username> password"
Search: "HackTheBox <machine> user flag"
Search: "<machine> grep password config"
```

## Automation

### Quick Writeup Search Script
```bash
#!/bin/bash
MACHINE="$1"
echo "Searching for writeups..."
echo ""
echo "=== 0xdf ==="
curl -s "https://0xdf.gitlab.io/" | grep -i "$MACHINE" | head -5
echo ""
echo "=== Search queries to try ==="
echo "1. HTB $MACHINE writeup site:medium.com"
echo "2. HackTheBox $MACHINE walkthrough"
echo "3. $MACHINE privilege escalation HTB"
```

## Integration with Workflow

When invoking this skill:

1. **Identify what you're stuck on**
   - Initial access?
   - Lateral movement?
   - Privilege escalation?

2. **Search with context**
   - Include service names
   - Include version numbers
   - Include error messages

3. **Extract actionable steps**
   - Don't just read - create commands
   - Note exact file paths
   - Copy credentials exactly

4. **Verify against target**
   - Writeups may be for different versions
   - Paths/usernames may differ
   - Adapt techniques to your situation